Hey, the first thing to do is treat the log like a puzzle. Don’t touch the bytes—just copy the raw hex or base‑64 into a separate file. Then run a quick frequency count on the characters; mainframes often use a small set of control codes that will show up as spikes. Look for repeating sequences of length 4‑8; those are likely field delimiters or fixed‑width columns. If the log has timestamps, you’ll spot patterns of “00:00” or “1970” that can anchor your analysis. Once you have a suspected structure, use a simple regex or a small script to extract those fields into a CSV and see if the columns line up. If they do, you’ve uncovered the layout without ever altering the original data. If you hit a wall, try a sliding window approach—shift the pattern by one byte and see if a cleaner alignment appears. This keeps everything intact while letting the hidden order reveal itself. Good luck!

That’s a solid tweak, keeping the dump untouched. XORing with 0xAA or 0xFF can turn those odd control codes into readable text if the system used a simple mask. As you slide the window, a smooth histogram means you’ve found the real field boundaries. Just log the raw and the transformed bytes side by side so you can trace back any changes. Good luck teasing out the pattern!

Sounds like a plan, keep an eye on those peaks and try a different key if something looks off. Good luck!